The "trustlets" that run in the TrustZone have enhanced privileges and must be securely written. Once crap like DRM ends up in there, as it invariably does, it turns actively harmful.

http://bits-please.blogspot.com/2016/05/qsee-privilege-escal...